TikTok was designated a “Very Large Online Platform” under the DSA in April 2023. The Commission opened proceedings covering protection of minors, advertising transparency, data access for researchers and addictive design.
The European Commission announced proceedings against TikTok two days after the Digital Services Act was published on 17 February.
After declaring that it serves more than ten per cent of the European Union's population — TikTok has approximately 135.9 million monthly active users in the EU region — it was designated a “Very Large Online Platform” under the DSA on 25 April 2023 and began its compliance work. It submitted a risk assessment report in September 2023.
In addition to that report, information and documents were requested from TikTok on illegal content, protection of minors and data access. On the basis of those submissions and the risk assessment report, the Commission opened proceedings to assess whether TikTok had breached the DSA in areas connected with the protection of minors, advertising transparency, data access for researchers, and the risk management of addictive design and harmful content.
The scope of the investigation covers the following:
- Algorithmic systems and the systemic risks of addiction that may arise from serving the same type of content consecutively; whether the measures applied — in particular age verification tools intended to protect physical and mental development, respect for children's rights and prevent minors accessing inappropriate content — are reasonable, proportionate and effective, and compliance with the DSA.
- Default privacy settings for minors as part of the design and operation of recommender systems, and whether appropriate and proportionate measures have been taken to ensure a high level of privacy, safety and security for minors.
- The compliance of advertising served with DSA obligations.
- Whether there are shortcomings in the measures taken on transparency of data access under Article 40 of the DSA.
- Whether Articles 34(1), 34(2), 35(1), 28(1), 39(1) and 40(12) of the DSA have been breached.
We recommend that companies providing services to the European Union complete their DSA compliance without delay.